WIP: Agent zones and secure per-Agent enrollment #3

2026-10-14T10:54:41-05:00

lussierj commented

2026-10-14 10:54:41 -05:00

Source: codex/review-03-zones-enrollment
Target: codex/review-02-windows-control

Summary

Adds durable Agent Zone configuration and routing, zone-aware miner control, secure enrollment, and per-Agent credential authentication.

Introduces migrations 0016_agent_zones and 0017_agent_enrollment.

Exact included commits

82309db — feat: add agent zones
d9f0da6 — feat: add secure agent enrollment

Dependencies

Depends on PRs 1–2, including migration 0015 and command-transport infrastructure. PR 4 targets this source branch.

Available validation evidence

The commits include zone, authentication, enrollment, PostgreSQL, and migration lifecycle tests.

Later Blocker #2 validation exercised authentication and enrollment behavior on the final prerequisite tree. That does not establish a passing isolated test result for this earlier endpoint.

Outstanding testing and security concerns

Run zone/enrollment suites and migration upgrade/downgrade tests against this endpoint.
Validate single-use enrollment, concurrent redemption, credential revocation, identity spoofing, occupied zones, and routing conflicts.
Validate existing deployments with missing Site/Zone assignments and ambiguous legacy identities.
This endpoint does not include the later legacy-routing backfill or durable legacy-auth retirement migrations. Do not deploy it as an independently approved existing-agent migration release.
Committed discovery ingestion performs global MAC/IP matching before ownership-conflict handling. Validate discovery isolation separately; later enrichment tests do not establish full discovery isolation.
Separate discovery-isolation work remains uncommitted and is excluded.

Deployment status

This PR is not approved for production deployment. Existing-agent rollout requires the later compatibility and transition foundation.

Source: `codex/review-03-zones-enrollment` Target: `codex/review-02-windows-control` ### Summary Adds durable Agent Zone configuration and routing, zone-aware miner control, secure enrollment, and per-Agent credential authentication. Introduces migrations `0016_agent_zones` and `0017_agent_enrollment`. ### Exact included commits - `82309db` — feat: add agent zones - `d9f0da6` — feat: add secure agent enrollment ### Dependencies Depends on PRs 1–2, including migration `0015` and command-transport infrastructure. PR 4 targets this source branch. ### Available validation evidence The commits include zone, authentication, enrollment, PostgreSQL, and migration lifecycle tests. Later Blocker #2 validation exercised authentication and enrollment behavior on the final prerequisite tree. That does not establish a passing isolated test result for this earlier endpoint. ### Outstanding testing and security concerns - Run zone/enrollment suites and migration upgrade/downgrade tests against this endpoint. - Validate single-use enrollment, concurrent redemption, credential revocation, identity spoofing, occupied zones, and routing conflicts. - Validate existing deployments with missing Site/Zone assignments and ambiguous legacy identities. - This endpoint does not include the later legacy-routing backfill or durable legacy-auth retirement migrations. Do not deploy it as an independently approved existing-agent migration release. - Committed discovery ingestion performs global MAC/IP matching before ownership-conflict handling. Validate discovery isolation separately; later enrichment tests do not establish full discovery isolation. - Separate discovery-isolation work remains uncommitted and is excluded. ### Deployment status This PR is not approved for production deployment. Existing-agent rollout requires the later compatibility and transition foundation.

lussierj added 2 commits 2026-10-14 10:54:42 -05:00

feat: add agent zones 82309db79a

feat: add secure agent enrollment d9f0da694b

lussierj referenced this pull request

2026-10-15 19:50:55 -05:00

WIP: Blocker #3 Stage A - Physical Command Security Containment #6

lussierj referenced this pull request

2026-10-19 09:41:00 -05:00

WIP: Blocker #1 - Agent Discovery Zone Isolation #7

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This pull request is marked as a work in progress.